Skip to content

v2.4.3 — Critical security patch + responsible-disclosure policy

Choose a tag to compare

View all tags
@alikahwaji alikahwaji released this 19 Apr 02:07
· 174 commits to main since this release
v2.4.3
24dcdc3

v2.4.3 — Critical security patch + responsible-disclosure policy

Security release. Patches two CVEs in the runtime dependency tree. Recommended for all consumers of 2.4.x.

🔒 Security fixes

axios upgraded 1.8.4 → 1.15.0

Closes two critical advisories:

follow-redirects (transitive) patched

GHSA-r4q5-vmmm-2653 — moderate auth-header leak on cross-domain redirects.

Result

npm audit --omit=dev now reports 0 vulnerabilities for runtime dependencies.

🛠 CI hardening

  • Supply-chain workflow runs npm audit with --omit=dev (was the deprecated --production flag) and scopes the license allowlist to runtime deps only — dev-only licenses no longer break the build, since they don't ship to consumers
  • Unlicense and CC-PDDC added to the license allowlist as legitimate public-domain dedications

📜 New: SECURITY.md

Responsible-disclosure policy ships in the tarball, covering:

  • Triage SLAs: 72 h acknowledgement · 7 d severity rating · 14 d patch for confirmed critical/high
  • Supported versions matrix
  • Safe-harbor clause for good-faith research
  • Scope (what's in vs. out)
  • Hardening practices already in place (pinned Actions by SHA, Dependabot, runtime audit gate, license enforcement, SBOM)

GitHub auto-detects SECURITY.md and adds private vulnerability reporting via the Security tab.

📝 New: CHANGELOG.md

Replaces git-history-as-changelog with Keep a Changelog format covering every release from 2.4.0 onward. Ships in the tarball.

✏️ Refreshed package description

package.json description now reads:

Composable RAG for Node.js — with built-in evaluation, citations, guardrails, and observability.

This is the single most visible string for the package — it drives npm search results, VS Code package.json hover, and GitHub repo About box.

📦 Tarball

  • 533 KB · 223 files

Migration

No API changes. Auto-merge friendly per our SEMVER policy (added in v2.4.4).

Full changelog

CHANGELOG.md → 2.4.3

Install

npm install @devilsdev/rag-pipeline-utils@2.4.3

npm: https://www.npmjs.com/package/@devilsdev/rag-pipeline-utils/v/2.4.3

Assets 2
Loading